Hugh D. Gamble         905 787 1849

40 Church St. South

Richmond Hill, ON L4C 1W2

 

Email: hugh@PhaedraV.com

 


Qualifications:

 

·         Experienced Information Technologies (IT) Security Manager and Consultant.

·         Over twenty years of experience in IT and Software Development.

·         Design and Implementation of Systems and Network Security Architecture.

·         Keep current on industry and government standards through meetings with policy makers and attending seminars.

 

 

Employment History:

 

Principal, Phaedra V.                                       2002 – Present

 

·         Network and systems security architecture consulting: I also monitor security threats and legislation on an ongoing basis.

·         Software Application Architecture: Software design and implementation from life cycle management to development of secure e-business systems including IIS & Apache Web servers, MS SQL & MySQL Databases.

·         Technical management: vendor management, system integration, and International projects.

 

Security Analyst, Empire Financial                    April 2004 – March 2005

 

·         With good IT Security and Access Control teams in place, Empire was preparing for an increasing emphasis on e-business by evaluating, co-ordinating, and updating their entire security architecture. I was brought in initially to collect and document existing security procedures, processes and policies. Following my completion of a five hundred page Security Administration Manual, they proceeded with the new Security Architecture. After an evaluation of LDAP Directory Services and Identity Management vendors I continued in the role of Security Analyst to implement a comprehensive security management “dashboard” console, monitoring the Cisco firewall and VPN devices and network authentications for Windows and Solaris.

 

Technical Lead, ICE.                                  Dec. 1996 – Sept. 2001

 

·         managed internal IT security: supervised IT department in matters of network and system security and information privacy policy and planning. I designed and monitored network security including the installation of firewalls, CISCO VPN hardware with IPSec, email virus scanners. Network vulnerability assessments with Cybercop and Nessus. Maintained OS configuration and patches for Solaris and Windows in accordance with security best practices.

·         intrusion detection and forensics: monitored network and system logs, tracked down attackers, emergency response and repair

·         systems and network design and security: designed system security architecture, VPN, firewalls, virus scanners, OS patching for IT and client projects including: Bank of Montreal EFS Intranet; Signature Vacations and Dominion Bond Rating Service e-business systems. I was responsible for writing test plans, auditing security, and re-evaluating after recommended actions had been taken. The designs ensured security for all tiers of the application architecture from internal databases to public web servers. Operated Noranda’s website working with IBM for AIX systems and network security.

·         privacy policies and statements: consulted on legal and client confidence requirements for web projects, validated compliance of technical architecture with policy. Tracked Bill C6 compliance for clients in regulated industries.

·         e-business software privacy and risk assessment: evaluated existing systems for vulnerabilities, network scans, system audits.

·         LDAP: implemented corporate directory in OpenLDAP, ported to Sun iPlanet LDAP Directory Server. Migration towards ‘single sign on’ identity management. Some interfacing with Active Directory required for Windows 2000 servers.

·         e-business software architecture: worked on s/w architecture of enterprise Java eCommerce system for LaSenza lingerie in WebSphere, Signature Vacations and Dominion Bond Rating Service with J2EE in BEA WebLogic. Working with the development teams to ensure proper implementation of my security architecture.

 

Specific client projects in which I played a key role include: Bank of Montreal and Nortel Intranets and live webcasts; system security design of e-business websites and transactional systems for Signature Vacations and Dominion Bond Rating Service implemented with J2EE in BEA WebLogic. I was solely responsible for security in the systems and network designs, performing security audits with network and system scanning tools, and intrusion detection and forensics.

 

Manager, Advanced Systems, NTT.                       Jul. 1990 – Sept. 1996

 

·         Secure network administration: managed a lab network with Solaris and NFS for reliability and security at the Department of Defence.

·         Software programming: networked system programming in C++ and Java.

·         networked kiosk security: ensured robust and secure communication for a nation wide network of retail kiosks, supervised primary contractors.

 

For the K-mart retail kiosk network I got a colleague on the PGP development team to make us a custom version of the MD4 code for my use in password authentication when updating the kiosk database.

 

Staff Manager – Engineering Design, Bell Canada.      May 1986 – Sept. 1989

 

·         Integrated Office Systems development: evaluated and selected vendors and products for inclusion in the IOS product portfolio, included system security analysis of Unix minicomputers and PC LANs.

 

 

Co-op Student, Bell Northern Research.                Sept. 1983 – Sept. 1984

 

·         data processing and business analysis of the pending divestiture of AT&T. 

·         Expert Systems for telephony software.

 

Summer Student, Atomic Energy of Canada Limited.      Jun. 1980 – Aug. 1980

 

Programming and debugging PDP-11 assembler code for the Therac 25 linear accelerator that was then under development in the Medical Products Division.

 

 

Other relevant experience:

 

·         UNIX: owned and administrated networked UNIX systems since 1982.

·         Windows 2000, Windows 2003: administrate server with Active Directory.

·         University computer security: detected and reported mainframe security violations while a student.

·         Microsoft .NET and IBM J2EE seminars.

·         IBM Web Services training.

 

 

Education:

 

I have completed a B.Sc. in computer science at the University of Toronto, studying part time after starting at the University of Georgia with a National Merit scholarship

 

IPv6 Sage certification – Hurricane Electric

 

 

Published papers:

 

Perceptual Control and Layered Protocols in Interface Design I: Fundamental Concepts

International Journal of Human-Computer Studies, 50, 489-520, (1999)

M.M.Taylor, P.F.H.Farrell, H. Gamble, and J. Hollands

 

An Expert System Opponent for Wargaming

DCIEM Report No. 93-54, April 1995

T.R.H. Cutmore, H.D. Gamble

 

E-business Security whitepaper for ICE

 

 

Conferences:

 

Colorado Software Summit http://www.softwaresummit.com/

 

8th International WWW Conference

 

Computers Freedom and Privacy 2000

 

iBAND broadband networking conference

 

Content Delivery Network conference

 

IPMulticast conference

 

Netscape Developers Conference

 

 

Skills: Unix/Linux, Microsoft Windows, TCP/IP, HTTP, PKI, Firewall, VPN, LDAP, SSL, IPsec, BackTrack, Cybercop, nessus, nmap, enVision, Security Event Monitoring, CA-Top Secret, ISO 17799, Java, C++, XML, Shell, awk, PERL, technical writing.

 

 

References:

 

Available on request.